CVE-2025-68199

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> codetag: debug: handle existing CODETAG_EMPTY in mark_objexts_empty for slabobj_ext<br /> <br /> When alloc_slab_obj_exts() fails and then later succeeds in allocating a<br /> slab extension vector, it calls handle_failed_objexts_alloc() to mark all<br /> objects in the vector as empty. As a result all objects in this slab<br /> (slabA) will have their extensions set to CODETAG_EMPTY.<br /> <br /> Later on if this slabA is used to allocate a slabobj_ext vector for<br /> another slab (slabB), we end up with the slabB-&gt;obj_exts pointing to a<br /> slabobj_ext vector that itself has a non-NULL slabobj_ext equal to<br /> CODETAG_EMPTY. When slabB gets freed, free_slab_obj_exts() is called to<br /> free slabB-&gt;obj_exts vector. <br /> <br /> free_slab_obj_exts() calls mark_objexts_empty(slabB-&gt;obj_exts) which will<br /> generate a warning because it expects slabobj_ext vectors to have a NULL<br /> obj_ext, not CODETAG_EMPTY.<br /> <br /> Modify mark_objexts_empty() to skip the warning and setting the obj_ext<br /> value if it&amp;#39;s already set to CODETAG_EMPTY.<br /> <br /> <br /> To quickly detect this WARN, I modified the code from<br /> WARN_ON(slab_exts[offs].ref.ct) to BUG_ON(slab_exts[offs].ref.ct == 1);<br /> <br /> We then obtained this message:<br /> <br /> [21630.898561] ------------[ cut here ]------------<br /> [21630.898596] kernel BUG at mm/slub.c:2050!<br /> [21630.898611] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP<br /> [21630.900372] Modules linked in: squashfs isofs vfio_iommu_type1 <br /> vhost_vsock vfio vhost_net vmw_vsock_virtio_transport_common vhost tap <br /> vhost_iotlb iommufd vsock binfmt_misc nfsv3 nfs_acl nfs lockd grace <br /> netfs tls rds dns_resolver tun brd overlay ntfs3 exfat btrfs <br /> blake2b_generic xor xor_neon raid6_pq loop sctp ip6_udp_tunnel <br /> udp_tunnel nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib <br /> nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct <br /> nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 <br /> nf_tables rfkill ip_set sunrpc vfat fat joydev sg sch_fq_codel nfnetlink <br /> virtio_gpu sr_mod cdrom drm_client_lib virtio_dma_buf drm_shmem_helper <br /> drm_kms_helper drm ghash_ce backlight virtio_net virtio_blk virtio_scsi <br /> net_failover virtio_console failover virtio_mmio dm_mirror <br /> dm_region_hash dm_log dm_multipath dm_mod fuse i2c_dev virtio_pci <br /> virtio_pci_legacy_dev virtio_pci_modern_dev virtio virtio_ring autofs4 <br /> aes_neon_bs aes_ce_blk [last unloaded: hwpoison_inject]<br /> [21630.909177] CPU: 3 UID: 0 PID: 3787 Comm: kylin-process-m Kdump: <br /> loaded Tainted: G        W           6.18.0-rc1+ #74 PREEMPT(voluntary)<br /> [21630.910495] Tainted: [W]=WARN<br /> [21630.910867] Hardware name: QEMU KVM Virtual Machine, BIOS unknown <br /> 2/2/2022<br /> [21630.911625] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS <br /> BTYPE=--)<br /> [21630.912392] pc : __free_slab+0x228/0x250<br /> [21630.912868] lr : __free_slab+0x18c/0x250[21630.913334] sp : <br /> ffff8000a02f73e0<br /> [21630.913830] x29: ffff8000a02f73e0 x28: fffffdffc43fc800 x27: <br /> ffff0000c0011c40<br /> [21630.914677] x26: ffff0000c000cac0 x25: ffff00010fe5e5f0 x24: <br /> ffff000102199b40<br /> [21630.915469] x23: 0000000000000003 x22: 0000000000000003 x21: <br /> ffff0000c0011c40<br /> [21630.916259] x20: fffffdffc4086600 x19: fffffdffc43fc800 x18: <br /> 0000000000000000<br /> [21630.917048] x17: 0000000000000000 x16: 0000000000000000 x15: <br /> 0000000000000000<br /> [21630.917837] x14: 0000000000000000 x13: 0000000000000000 x12: <br /> ffff70001405ee66<br /> [21630.918640] x11: 1ffff0001405ee65 x10: ffff70001405ee65 x9 : <br /> ffff800080a295dc<br /> [21630.919442] x8 : ffff8000a02f7330 x7 : 0000000000000000 x6 : <br /> 0000000000003000<br /> [21630.920232] x5 : 0000000024924925 x4 : 0000000000000001 x3 : <br /> 0000000000000007<br /> [21630.921021] x2 : 0000000000001b40 x1 : 000000000000001f x0 : <br /> 0000000000000001<br /> [21630.921810] Call trace:<br /> [21630.922130]  __free_slab+0x228/0x250 (P)<br /> [21630.922669]  free_slab+0x38/0x118<br /> [21630.923079]  free_to_partial_list+0x1d4/0x340<br /> [21630.923591]  __slab_free+0x24c/0x348<br /> [21630.924024]  ___cache_free+0xf0/0x110<br /> [21630.924468]  qlist_free_all+0x78/0x130<br /> [21630.924922]  kasan_quarantine_reduce+0x11<br /> ---truncated---